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DETAILED ACTION 

1 . Applicant's arguments filed March 22, 2006, have been fully considered but they 
are not persuasive. 

2. Claims 1-24 are pending and have been examined. 

Response to Amendment 

3. The objection to the abstract is withdrawn. 

4. The objections to the specification are withdrawn. 

5. The objections to the drawings are not withdrawn. Examiner contacted 
"Scanner Customer Support" and requested the documents were reviewed in search for 
the drawings filed January 8, 2002. There were none found. Examiner respectfully 
requests the corrected drawings. 

6. The objection to claim 17 regarding the period instead of the semi-colon is 
withdrawn. 

7. The applicant has not traversed the examiner's use of official notice with regards 
to the claimed limitations found in claim 5, these features are taken by the examiner to 
be admitted prior art since the applicant has not adequately challenged the examiner's 
use of official notice (see MPEP 2144.03(c), 2144.04). 

Drawings 

8. New corrected drawings in compliance with 37 CFR 1.121(d) are required in this 
application because the handwritten reference characters on figures 1 and 3 are not 
clear. Applicant is advised to employ the services of a competent patent draftsperson 
outside the Office, as the U.S. Patent and Trademark Office no longer prepares new 
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drawings. The corrected drawings are required in reply to the Office action to avoid 
abandonment of the application. The requirement for corrected drawings will not be held 
in abeyance. 

Claim Objections 

9. Claim 12 is objected to because of the following informalities: "receiving at 
randomly generated time intervals". What is being received at randomly generated time 
intervals? Appropriate correction is required. 

Claim Rejections - 35 USC § 103 

10. The text of those sections of Title 35, U.S. Code not included in this action can 
be found in a prior Office action. 

11. Claims 1-7 and 9-24 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over O'Flaherty et al. (US Patent 6,275,824, hereinafter O'Flaherty), 
and further in view of Williams (US Patent Application Publication 2003/0005331). 

Regarding claims 1 and 20, O'Flaherty teaches a data management system, 
comprising: an access control system for limiting access to the data management 
system to authorized entities (column 11, lines 35-60); a data confidentiality system for 
identifying and concealing confidential details in received data (column 8, lines 10-61); a 
data storage system for storing the received data (column 4, lines 1-67); a data update 
system for periodically examining stored data to identify and expose any confidential 
details that have become non-confidential details (column 5, lines 45-67, column 6, lines 
1-35). OTIaherty does not expressly disclose that the details in the received data are 
one of secret, temporarily secret, possibly secret, and not secret, wherein secret, 
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temporarily secret, and possibly secret comprise confidential details. However, Williams 
teaches applying labels to data (top secret, secret, etc.) (paragraphs 102-138) and 
maintaining and preventing access to unauthorized entities (paragraphs 167-191). 
Therefore, it would have been obvious to one having ordinary skill in the art at the time 
the invention was made to apply the access control teachings of Williams to the system 
of O'Flaherty. One of ordinary skill in the art would have been motivated to do so to 
provide access control, object reuse, labeling, identification and authentication, and 
auditing to a secure network (Williams, paragraphs 2-24). 

Regarding claim 12, O'Flaherty teaches a data management system, 
comprising: an access control system for limiting access to the data management 
system to authorized entities (column 11, lines 35-60); a data decryption system for 
receiving at randomly generated time intervals and decrypting received operational risk 
data (column 4, lines 60-67, column 5, lines 1-63, column 10, lines 50-60); a data 
confidentiality system for identifying and concealing confidential details in the received 
data (column 8, lines 10-61); a data storage system for storing received data after the 
confidential details have been concealed (column 4, lines 1-67); a data update system 
for periodically examining stored data to identify and expose any confidential details that 
have become non-confidential details (column 5, lines 45-67, column 6, lines 1-35); a 
program approval system for approving systems for analyzing the stored data (column 
4, lines 35-60). O'Flaherty does not expressly disclose details in the received data as 
one of secret, temporarily secret, possibly secret, and not secret, wherein secret, 
temporarily secret, and possibly secret comprise confidential details or a key security 
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system for protecting encryption keys. However, Williams teaches applying labels to 
data (top secret, secret, etc.) (paragraphs 102-138), maintaining and preventing access 
to unauthorized entities (paragraphs 167-191), and protecting encryption keys 
(paragraphs 153-176). Therefore, it would have been obvious to one having ordinary 
skill in the art at the time the invention was made to apply the access control teachings 
of Williams to the system of O'Flaherty. One of ordinary skill in the art would have been 
motivated to do so to provide access control, object reuse, labeling, identification and 
authentication, and auditing to a secure network (Williams, paragraphs 2-24). 

Regarding claim 16, O'Flaherty teaches a method for managing data, 
comprising: receiving operational risk data at randomly generated time intervals in a 
secured manner from an authorized provider (column 4, lines 60-67, column 5, lines 1- 
63, column 10, lines 50-60); identifying and concealing confidential details in the 
received data (column 8, lines 10-61); storing the received data (column 4, lines 1-67); 
and updating the stored data by identifying and exposing any confidential details that 
have become non-confidential details in the stored data (column 5, lines 45-67, column 
6, lines 1-35). OTIaherty does not expressly disclose that the details in the received 
data as one of secret, temporarily secret, possibly secret, and not secret, wherein 
secret, temporarily secret, and possibly secret comprise confidential details. However, 
Williams teaches applying labels to data (top secret, secret, etc.) (paragraphs 102-138), 
maintaining and preventing access to unauthorized entities (paragraphs 167-191), and 
protecting encryption keys (paragraphs 153-176). Therefore, it would have been 
obvious to one having ordinary skill in the art at the time the invention was made to 
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apply the access control teachings of Williams to the system of OTIaherty. One of 
ordinary skill in the art would have been motivated to do so to provide access control, 
object reuse, labeling, identification and authentication, and auditing to a secure 
network (Williams, paragraphs 2-24). 

Regarding claims 2, 17, and 21, the combination of O'Flaherty and Williams 
teaches the limitations as set forth above. Furthermore, the combination of O'Flaherty 
and Williams teaches a data decryption system for decrypting received data (O'Flaherty, 
column 4, lines 60-67, column 5, lines 1-63, column 10, lines 50-60); a data verification 
system for verifying an accuracy of received data (Williams, paragraphs 8-18); a 
program approval system for approving systems for analyzing the stored data 
(O'Flaherty, column 4, lines 35-60); and a key security system for protecting encryption 
keys (Williams, paragraphs 153-176). 

Regarding claims 3, 13, 18, and 22, the combination of O'Flaherty and Williams 
teaches the limitations as set forth above. Furthermore, O'Flaherty teaches wherein 
stored data is analyzed with a data analysis system (column 9, lines 55-67, column 10, 
lines 1-49). 

Regarding claims 4, 14, 19, and 23, the combination of O'Flaherty and Williams 
teaches the limitations as set forth above. Furthermore, O'Flaherty teaches wherein the 
data analysis system is permitted to analyze the stored data based upon approval by 
full rights members of the data management system (column 8, lines 10-67). 

Regarding claim 5, the combination of O'Flaherty and Williams teaches the 
limitations as set forth above. Furthermore, Williams teaches wherein data management 
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system is a tamper resistant, tamper evident, tamper sensitive, tamper reactive, and 
programmable system (paragraphs 33, 151-168) and these features have been 
admitted per applicant to have been conventional and well known at the time the 
invention was made by the failure to adequately challenge the examiner's use of official 
notice. 

Regarding claim 6, the combination of O'Flaherty and Williams teaches the 
limitations as set forth above. Furthermore, O'Flaherty teaches wherein the received 
data and the stored data are operational risk data (column 4, lines 1-67). 

Regarding claim 7, the combination of O'Flaherty and Williams teaches the 
limitations as set forth above. Furthermore, O'Flaherty teaches wherein the system 
mitigates operational risk (column 4, lines 1-67). 

Regarding claim 9, the combination of O'Flaherty and Williams teaches the 
limitations as set forth above. Furthermore, O'Flaherty teaches wherein the confidential 
details cannot be accessed by any entity (column 5, lines 15-67). 

Regarding claim 10, the combination of O'Flaherty and Williams teaches the 
limitations as set forth above. Furthermore, O'Flaherty teaches wherein the confidential 
details can only be accessed by a plurality of entities acting in concert (column 9, lines 
15-55). 

Regarding claim 11, the combination of O'Flaherty and Williams teaches the 
limitations as set forth above. Furthermore, O'Flaherty teaches a customer relationship 
management tool for verifying a policy of an entity (column 1 1 , lines 5-67). 
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R garding claim 15, the combination of O'Flaherty and Williams teaches the 
limitations as set forth above. Furthermore, O'Flaherty teaches wherein a provider 
submits the operational risk data to the data management system, and wherein a 
requester accesses the stored data (column 4, lines 1-67, column 5, lines 1-67, column 

11. lines 35-60). 

Regarding claim 24, the combination of O'Flaherty and Williams teaches the 
limitations as set forth above. Furthermore, O'Flaherty teaches wherein the received 
data is operational risk data (column 4, lines 1-67). 

12. Claim 8 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
O'Flaherty and Williams, and further in view of Scott et al. (US Patent Application 
Publication 2002/0082996, hereinafter "Scott"). 

Regarding claim 8, the combination of O'Flaherty and Williams does not 
expressly disclose wherein data is received based upon a randomly generated time 
interval. However, Scott teaches wherein data is received based upon a randomly 
generated time interval (page 3, paragraph 28). Therefore, it would have been obvious 
to one having ordinary skill in the art at the time the invention was made to receive data 
at randomly generated time intervals. One of ordinary skill in the art would have been 
motivated to do so to provide flexibility on receiving data. 

Conclusion 

13. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. US Patent Application Publication 2004/0049679 to Meggle 
disclose using a tamper resistant/tamper evident authentication device. US Patent 
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Numbers 6,224,486 and 6,425,828 to Walker et al. disclose the use of tamper 
evident/resistant/reactive/sensitive systems/memory. 

14. Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 

§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

15. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to David G. Cervetti whose telephone number is (571) 272- 
5861. The examiner can normally be reached on Monday-Friday 7:00 am - 5:00 pm, off 
on Wednesday. 

16. If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz R. Sheikh can be reached on (571) 272-3795. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 
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17. Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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